In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page

JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages

JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection

JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI

JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI

In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS

An issue was discovered in JetBrains TeamCity 2018.2.4

JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of…

A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages

A possible stored JavaScript injection requiring a deliberate server administrator action was detected

A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages

In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly

In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload

In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command

In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots

In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible

In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data

In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute

In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible

In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS

In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page

In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings

In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings

In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin

In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin

In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page

In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab

In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible

In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible

In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible

In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration

In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration

In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible

In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible

In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible

In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible

In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible

In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible